From: Stephen Frost <sfrost@snowman.net>
To: Tim Watts <tim.j.watts@kcl.ac.uk>
Cc: pgsql-admin@postgresql.org
Subject: Re: Postgresql 8.4 GSSAPI auth with fallback to password prompting?
Date: Sun, 24 Mar 2013 14:47:10 -0400
Message-ID: <20130324184710.GI4361@tamriel.snowman.net> (raw)
In-Reply-To: <514AFB73.6050300@kcl.ac.uk>
References: <514AFB73.6050300@kcl.ac.uk>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-admin>
Tim,
* Tim Watts (tim.j.watts@kcl.ac.uk) wrote:
> Is it possible to specify GSSAPI auth (with MIT kerberos as the
> backend) but get Postgresql to fallback to prompting for a password
> if a kerberos ticket cannot be supplied by the client - eg because
> the client cannot do GSSAPI or because the client is not part of the
> kerberos realm?
You're right- it's a 'no'. It would also really degrade the security
which you get with Kerberos as you'd undoubtably end up with clients
storing those passwords and using them routinely instead of using
Kerberos.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 197B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: sfrost@snowman.net, tim.j.watts@kcl.ac.uk
Subject: Re: Postgresql 8.4 GSSAPI auth with fallback to password prompting?
In-Reply-To: <20130324184710.GI4361@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox